Enhanced Container Isolation (匷åãããã³ã³ããåé¢) ãšã¯ïŒ
匷åãããã³ã³ããåé¢ïŒEnhanced Container Isolationã以äžECIïŒã¯ Docker Business ã®ã客æ§ã®ã¿ãå©çšå¯èœã§ãã
匷åãããã³ã³ããåé¢ïŒECIïŒã¯ãã³ã³ããå ã§å®è¡ãããæªæã®ããã¯ãŒã¯ããŒãã Docker Desktop ããã¹ãã䟵害ããã®ãé²ãè¿œå ã®ã»ãã¥ãªãã£ã¬ã€ã€ãŒãæäŸããŸãã
ECI ã¯ãéçºè ã®çç£æ§ã«åœ±é¿ãäžããããšãªããã³ã³ããã®åé¢ã匷åããããã®ããŸããŸãªé«åºŠãªæè¡ã䜿çšããŸãã
ãŸããã¬ãžã¹ããªã¢ã¯ã»ã¹ç®¡çããªã·ãŒã Settings Management ãéããŠç®¡çè ã«ãã£ãŠäœæãããã»ãã¥ãªãã£æ§æãããã¯ããŸãã
ECI 㯠Docker ã§äœ¿çšãããŠããä»ã®ã³ã³ããã»ãã¥ãªãã£æè¡ïŒäŸãã°ãLinux Capabilities ã®åæžãseccompãAppArmorïŒãè£å®ãããã®ã§ãã
察象è
-
ã³ã³ããæ»æãé²ããéçºç°å¢ã®è匱æ§ãäœæžãããçµç¹ãéçºè ã
-
éçºè ã®ãã·ã³ã§ç°¡åãã€çŽæçã«å®æœã§ããããã匷åãªã³ã³ããåé¢ãå®çŸãããçµç¹ã
Enhanced Container Isolation ãæå¹ã«ãããšäœãèµ·ããïŒ
ECI ãæå¹ã«ãããšã以äžã®æ©èœãšã»ãã¥ãªãã£æè¡ãé©çšãããŸãïŒ
-
ãã¹ãŠã®ãŠãŒã¶ãŒã³ã³ãã㯠Linux ãŠãŒã¶ãŒããŒã ã¹ããŒã¹ã§èªåçã«å®è¡ããã匷åãªåé¢ãä¿èšŒãããŸããåã³ã³ããã¯å°çšã® Linux ãŠãŒã¶ãŒããŒã ã¹ããŒã¹å ã§å®è¡ãããŸãã
-
ã³ã³ããå ã® root ãŠãŒã¶ãŒã¯ Docker Desktop Linux VM å ã®éç¹æš©ãŠãŒã¶ãŒã«ãããã³ã°ãããŸãã
-
ã³ã³ããã䟵害ããã«ãããªããŸããäŸãã°ãéèŠãªã·ã¹ãã ã³ãŒã«ã粟æ»ããã
/proc
ã/sys
ã®äžéšãã³ã³ããå ã§ãšãã¥ã¬ãŒããããŸãã -
ãã¹ããã£ã¬ã¯ããªãããªã¥ãŒã ã®ãã€ã³ãããŠã³ããªã©ããŠãŒã¶ãŒã¯éåžžéãã³ã³ããã䜿çšã§ããŸãã
-
ã³ã³ããå®è¡æ¹æ³ã«å€æŽã¯ãªããç¹å¥ãªã³ã³ããã€ã¡ãŒãžã¯å¿ èŠãããŸããã
-
ç¹æš©ã³ã³ããïŒäŸïŒ
--privileged
ãã©ã°ïŒã¯æ©èœããŸãããã³ã³ããã® Linux ãŠãŒã¶ãŒããŒã ã¹ããŒã¹å ã§ã®ã¿ç¹æš©ãäžããããDocker Desktop VM ã§ã¯ç¹æš©ããããŸããããã®ãããDocker Desktop VM ã䟵害ããããšã¯ã§ããŸããã -
Docker-in-Docker ã Kubernetes-in-Docker ãåäœããŸãããDocker Desktop Linux VM å ã§éç¹æš©ãšããŠå®è¡ãããŸãã
ããã«ã以äžã®å¶éã課ãããŸãïŒ
-
ã³ã³ãã㯠Docker Desktop VM ãšããŒã ã¹ããŒã¹ãå ±æã§ããŸããïŒäŸïŒ
--network=host
ã--pid=host
ã¯äœ¿çšäžå¯ïŒã -
ã³ã³ãã㯠Docker Desktop VM å ã®æ§æãã¡ã€ã«ãå€æŽã§ããŸããïŒäŸ: VM ãã£ã¬ã¯ããªãã³ã³ããã«ããŠã³ãããããšã¯çŠæ¢ãããŠããŸãïŒã
-
ã³ã³ãã㯠Docker Engine ã«ã¢ã¯ã»ã¹ã§ããŸãããäŸãã°ãDocker Engine ã®ãœã±ãããã³ã³ããã«ããŠã³ãããããšã¯å¶éãããæªæã®ããã³ã³ããã Docker Engine ãå¶åŸ¡ããã®ãé²ããŸãããã ããä¿¡é Œã§ããã³ã³ããã€ã¡ãŒãžã«å¯ŸããŠã¯ç®¡çè ããã®å¶éãç·©åã§ããŸãã
-
Docker Desktop VM ãžã®ã³ã³ãœãŒã«ã¢ã¯ã»ã¹ã¯ãã¹ãŠã®ãŠãŒã¶ãŒã«å¯ŸããŠçŠæ¢ãããŠããŸãã
ãããã®æ©èœãšå¶éã«ãããå®è¡æã®ã³ã³ãããããå®å šã«ä¿è·ãããäžæ¹ã§ãéçºè ã®äœéšãçç£æ§ãžã®åœ±é¿ã¯æå°éã«æããããŸããéçºè ã¯éåžžéã Docker Desktop ã䜿çšã§ããŸãããèµ·åããã³ã³ããã¯ãã匷åã«åé¢ãããŸãã
ECI ã®åäœã«ã€ããŠè©³ããã¯ãä»çµã¿ãã芧ãã ããã
éèŠ ECI ã¯ãŸã Docker ãã«ããKubernetes ããããæ¡åŒµã³ã³ãããå®å šã«ã¯ä¿è·ããŠããŸãããæ¢ç¥ã®å¶éãåé¿çã«ã€ããŠã¯ãFAQ ãåç §ããŠãã ããã
Enhanced Container Isolation ãæå¹ã«ããæ¹æ³
éçºè ãšããŠ
éçºè ãšã㊠ECI ãæå¹ã«ããã«ã¯ïŒ
-
Organization ã Docker Business ãµãã¹ã¯ãªãã·ã§ã³ãå©çšããŠããããšã確èªããŸãã
-
Docker Desktop ã«ãµã€ã³ã€ã³ããOrganization ã«èªèšŒããŸããããã«ãããDocker Desktop ã®èšå®ã¡ãã¥ãŒã§ ECI æ©èœãå©çšå¯èœã«ãªããŸãã
-
æ¢åã®ãã¹ãŠã®ã³ã³ãããåæ¢ããŠåé€ããŸãã
-
Docker Desktop ã® Settings > General ã«ç§»åããŸãã
-
Use Enhanced Container Isolation ã®ãã§ãã¯ããã¯ã¹ãéžæããŸãã
-
Apply and restart ãéžæããŠèšå®ãä¿åããŸãã
éèŠ ECI ã¯æå¹ååã«äœæãããã³ã³ãããä¿è·ããŸãããæ¢ç¥ã®å¶éãåé¿çã«ã€ããŠã¯ãFAQ ãåç §ããŠãã ããã
管çè ãšããŠ
åææ¡ä»¶
ãµã€ã³ã€ã³ã®å¿ é å ããŸãå®æœãããã¹ãŠã® Docker Desktop éçºè ã Organization ã«èªèšŒããããã«ããŸããèšå®ç®¡çã«ã¯ Docker Business ãµãã¹ã¯ãªãã·ã§ã³ãå¿ èŠãªããããµã€ã³ã€ã³ã®å¿ é åã«ãã£ãŠãèªèšŒããããŠãŒã¶ãŒã ããæ©èœã«ã¢ã¯ã»ã¹ã§ãããã¹ãŠã®ãŠãŒã¶ãŒã«äžè²«ããŠæ©èœãé©çšãããããä¿èšŒããŸãã
èšå®æ¹æ³
admin-settings.json
ãã¡ã€ã«ãäœæããã³èšå® ãã以äžãæå®ããŸãïŒ
{
"configurationFileVersion": 2,
"enhancedContainerIsolation": {
"value": true,
"locked": true
}
}
"value": true
ãèšå®ãããšãECI ãããã©ã«ãã§æå¹ã«ãªããŸãã
"locked": true
ãèšå®ãããšãéçºè
ããã®æ©èœãç¡å¹ã«ã§ããªããªããŸããéçºè
ãæ©èœãç¡å¹ã«ã§ããããã«ãããå Žåã¯ã"locked": false
ãèšå®ããŠãã ããã
ããã«ãã³ã³ããã® Docker ãœã±ããããŠã³ãæš©éãèšå®ããããšãã§ããŸãã
é©çšããã«ã¯ïŒ
-
æ°ããã€ã³ã¹ããŒã«ã®å Žåãéçºè ã Docker Desktop ãèµ·åã㊠Organization ã«èªèšŒããå¿ èŠããããŸãã
-
æ¢åã®ã€ã³ã¹ããŒã«ã®å ŽåãDocker ã¡ãã¥ãŒãã Docker Desktop ãçµäºããåèµ·åããå¿ èŠããããŸãããã§ã«ãµã€ã³ã€ã³ããŠããå Žåãå€æŽãåæ ããããã«å床ãµã€ã³ã€ã³ããå¿ èŠã¯ãããŸããã
éèŠ Docker ã¡ãã¥ãŒãã Restart ãéžæããã ãã§ã¯äžååã§ãããã㯠Docker Desktop ã®äžéšã®ã³ã³ããŒãã³ãã®ã¿ãåèµ·åããããã§ãã
管çè ããã®èšå®ã匷å¶ããå ŽåããŠãŒã¶ãŒã¯äœãèŠãïŒ
ãããã®èšå®ã Docker Admin Console ã§æ§æããããšãã§ããŸãã
ECI ãæå¹ãªå ŽåããŠãŒã¶ãŒã¯ä»¥äžã確èªã§ããŸãïŒ
- Settings > General 㧠Use Enhanced Container Isolation ããªã³ã«ãªã£ãŠããŸãã
- ã³ã³ãã㯠Linux ãŠãŒã¶ãŒããŒã ã¹ããŒã¹å ã§å®è¡ãããŸãã
確èªããã«ã¯ã以äžãå®è¡ããŸãïŒ
$ docker run --rm alpine cat /proc/self/uid_map
以äžã®åºåã衚瀺ãããŸãïŒ
0 100000 65536
ããã¯ãã³ã³ããã® root ãŠãŒã¶ãŒïŒ0ïŒã Docker Desktop VM å ã®éç¹æš©ãŠãŒã¶ãŒïŒ100000ïŒã«ãããã³ã°ãããŠããããã®ãããã³ã°ã64Kã®ãŠãŒã¶ãŒIDç¯å²ã«ãããããšã瀺ããŠããŸããã³ã³ããããã»ã¹ãã³ã³ããããšã¹ã±ãŒãããå Žåã§ããVM ã¬ãã«ã§ç¹æš©ãæããªãããšãæå³ããŸãããã®ãŠãŒã¶ãŒIDãããã³ã°ã¯åã³ã³ããããšã«ç°ãªããåã³ã³ããããã¹ããŠãŒã¶ãŒIDã®å°çšç¯å²ãååŸããŸãããŠãŒã¶ãŒIDã®ãããã³ã°ã¯ Docker Desktop ã«ãã£ãŠèªåçã«ç®¡çãããŸãã詳现ã«ã€ããŠã¯ãECI ã®ä»çµã¿ãåç §ããŠãã ããã
äžæ¹ãECI ãæå¹ã§ãªãå ŽåãLinux ãŠãŒã¶ãŒããŒã ã¹ããŒã¹ã¯äœ¿çšãããã以äžã®åºåã衚瀺ãããŸãïŒ
0 0 4294967295
ããã¯ãã³ã³ããå ã® root ãŠãŒã¶ãŒïŒ0ïŒã Docker Desktop VM ã® root ãŠãŒã¶ãŒïŒ0ïŒã§ãããã³ã³ããåé¢ãäœäžããããšãæå³ããŸãã
ECI 㯠Sysbox ã³ã³ããã©ã³ã¿ã€ã ã Docker Desktop Linux VM å
ã§äœ¿çšããŠãããããECI ãæå¹ãã©ããã確èªããå¥ã®æ¹æ³ãšããŠãdocker inspect
ã䜿çšã§ããŸãïŒ
$ docker inspect --format='{{.HostConfig.Runtime}}' my_container
以äžã®åºåã衚瀺ãããŸãïŒ
sysbox-runc
ECI ãæå¹ã§ãªãå Žåãdocker inspect
ã¯æšæºã® OCI ã©ã³ã¿ã€ã ã§ãã runc
ãåºåããŸãã